Detecting Poisoned Documents in External Connector Pipelines Before They Manipulate AI Responses

Indirect prompt injection detection in enterprise RAG pipelines must begin at ingestion, before connector content becomes trusted knowledge. Protecting responses requires provenance checks, document anomaly scoring, and generation-time monitoring, backed by an architecture that prevents untrusted evidence from directly authorizing answers. Each layer addresses a different failure point, so detecting suspicious content must be paired with controls that stop the system from acting on it.

Why connector pipelines create a poisoning attack surface that generic security tools miss

Connector poisoning begins before a user asks a question. An attacker who can write to an indexed source can place adversarial content in the knowledge base without changing the model, system prompt, or runtime components. Retrieval later presents that content as grounding evidence. The immediate breach is therefore one of supply-chain integrity, even though its eventual effect appears in an AI response.

That timing changes where defenses belong. Output sanitization and inference-time content checks may catch a harmful response, but they cannot prevent an earlier admission of poisoned material into the index. Safety training likewise does not validate the source corpus. OWASP formalized vector and embedding weaknesses as LLM08:2025, a distinct category absent from its earlier Top 10.

The persistence is just as important as the entry point. Once a poisoned chunk is in the index, it can stay there through model updates, system prompt changes, and API key rotations until the vector store is cleaned. If the threat enters during ingestion, the detection framework must begin there.

How connector poisoning works in practice across SharePoint, OneDrive, and MCP sources

Microsoft's Copilot Retrieval API returns text from SharePoint, OneDrive, and Copilot connectors as grounding context. A user or connected system with write access can change that content before the assistant reads it. Write access becomes a route to response manipulation. In this threat model, an employee who can modify an indexed document can occupy the same structural position as an external attacker.

ConfusedPilot, presented at DEF CON AI Village 2024, showed how write access to indexed data sources could be used for response poisoning. Symmetry Systems describes the access requirement as “any identity with access to save documents or data to an environment indexed by the AI copilot,” encompassing environments beyond SharePoint folders. The research also demonstrated persistence through index caching after malicious content was removed.

MCP has a related problem with the boundary between data and instructions in tool descriptions. Microsoft’s security guidance identifies the blending of instructions and data in agentic connectors as a primary vulnerability. A change to tool metadata can redirect agent behavior, making the description itself a source of instructions. Even with a legitimate connector, the system must control which parts of its content can influence behavior.

Why a small number of injected documents can control a large knowledge base

Similarity search selects documents for their apparent relevance to a query, independently of their share of the knowledge base. An attacker who knows the retriever can optimize poisoned text to rank highly for target queries. The similarity function becomes the lever.

PoisonedRAG, presented by Zou et al. at USENIX Security 2025, demonstrated that a small amount of malicious text could dominate retrieval within a much larger corpus and steer generated answers. GMTP’s study explains why this creates a detection challenge. The poison is engineered to look highly relevant to the questions it targets. Relevance, in other words, cannot serve as proof of integrity.

Confundo, introduced by Hu et al. in 2026, extended this approach with a poison generator fine-tuned to survive preprocessing, reranking, and paraphrasing. AgentPoison, presented at NeurIPS 2024, showed a similar way in, using backdoor trigger tokens in agent memory or knowledge-base entries without model fine-tuning. Once selected, poisoned chunks can reach downstream consumers much like a compromised dependency propagating through a software supply chain.

Why detection-only approaches share a blind spot that adaptive attackers already exploit

CORDON-MAS research identifies a monitoring-control gap in which a model can recognize suspicious retrieved evidence yet still endorse its claims in an answer. The missing step is control over what the system commits to saying or doing.

Individual detectors also have different blind spots. GMTP is strong against token-optimized poison but weaker against natural-language carrier attacks and fluent CPA-RAG variants. RAGSieve’s query-time component works well against many attack types, but some attacks using jointly written, fluent CPA-RAG documents still succeed. Corpus inspection and serial deployment reduce that exposure without eliminating it.

Adaptive attackers deliberately work within these gaps. Low-perplexity, fluent poison can evade filters that look for unusual language, while Confundo-style attacks are designed to survive common pipeline transformations. These limits establish why each detector needs a defined role, a complementary layer, and an operational response when it fires.

Stage one: document provenance validation before content enters the index

Provenance validation asks who supplied a document, who could change it, and how it reached the ingestion pipeline. For SharePoint and OneDrive feeds, that means validating origin, write permissions, and chain of custody before embedding. Each external connector feed should go into its own landing zone before it is mixed with higher-trust material. That separation limits the reach of a compromised source.

Unexpected additions or modifications to indexed folders should trigger a hold-and-review gate. Cryptographically signed or vetted additions can prevent public-inject attacks from entering the index by requiring proof of origin. For external APIs and partner feeds, service-to-service authentication, TLS, and least-privilege credentials protect the path by which documents arrive.

A government AI security organization published MCP design guidance in May 2026 stating that established cyber defense strategies do not adequately address the novel and systemic risks of agentic AI systems featuring MCP. The guidance recommends signed provenance for dynamic discovery among its compensating controls. This makes origin validation relevant to changing tool sources as well as document feeds.

Authorized users can still submit optimized injections, so provenance reduces the entry surface without ensuring that content is free of injections. That remaining exposure is the purpose of the next stage.

Stage two: anomaly scoring at ingestion to catch what provenance checks pass

Gradient-based masked token probability, or GMTP, examines how a document earns its retrieval score. It uses gradients of the retriever’s similarity function to identify high-impact tokens, then masks those tokens and checks their probability with a masked language model. Unusually low probabilities can reveal adversarial token choices. GMTP eliminates over 90% of poisoned content across the datasets and adversarial settings described in the research while retaining relevant documents.

That signal is strongest against token-level optimization artifacts. Fluent attacks may contain no equally conspicuous tokens, so individual-document scoring needs a complementary view of the corpus. RAGSieve’s corpus inspection component, RSG, compares a document’s strongest semantic relations with its own neighborhood floor. Clusters of coordinated injections can cause density spikes that checks of one document at a time miss.

Sparse-attention approaches address a different part of the mechanism. They limit how strongly any single retrieved document can dominate generation, reducing the amplification available to a small injection. They work alongside ingestion scoring, which still decides what to admit.

Operationally, scoring should provide a quarantine gate with provisional decisions about content safety. Documents above a threshold should be held for review before admission to the live index.

Stage three: generation-time activation monitoring to catch what ingestion filters miss

RevPRAG, presented at EMNLP 2025 by researchers at Fudan University and Worcester Polytechnic Institute, analyzes LLM activations for the final input token across all layers. Its research finds distinguishable patterns between poisoned and correct responses, with a high true positive rate and a low false positive rate. Poison that passed ingestion can still become visible when it influences generation.

RevPRAG detects poisoned responses before delivery, so it belongs in the response path. It does not identify poisoned documents that have not yet been queried. An activation alert also leaves the answer itself to be corrected.

MemAudit provides a different capability through causal attribution and structural anomaly detection for poisoned agent memory. Its role here is post-incident forensics, tracing the evidence responsible after a poisoned response has already been issued. That makes it useful for investigation, but not interchangeable with a pre-delivery detector.

An operating team therefore needs separate workflows for interception and attribution. A generation-time alert should trigger response suppression, followed by quarantine and re-audit of the documents that grounded the flagged answer. Forensic analysis can then help trace the cause.

Why information-flow control is the architectural backstop when all three detection layers face adaptive attackers

What happens when poison passes every detector? Information-flow control addresses that possibility by separating access to raw evidence from authority to synthesize the final answer. CORDON-MAS keeps these roles separate by using agents with different access rights. It is a research architecture that has yet to become an available shipping product or plug-in.

A dedicated Extractor reads raw documents and converts them into structured evidence claim cards. An Auditor evaluates those claims through cross-source consistency, while a Gate supplies an independent second blocking layer. The Synthesizer generates answers exclusively from certified claims.

Across five BEIR datasets, the architecture reduced attack success rate by 92.4% relative to undefended RAG, including against adaptive and Confundo-style attacks. Its ablation analysis identifies the Auditor as the most critical component. Multi-document consistency collusion remains the main limit on what the system can guard against.

The Cordon Principle concerns system topology rather than model size, prompt sophistication, or retrieval quality. Its value is that the system does not rely only on recognizing every poisoned passage before that passage can influence output. Upstream controls still reduce the volume and variety of poison reaching this backstop. For teams building or evaluating RAG infrastructure, the lesson is to inspect who can read untrusted evidence and who is authorized to turn it into an answer.

Applying the four-stage framework across enterprise connector ecosystems with continuous monitoring

A connector framework cannot remain a point-in-time assessment. Each new SharePoint site, OneDrive location, or MCP server expands the set of sources that can influence an assistant. Provenance validation and anomaly scoring therefore need to apply at onboarding, before the source is in use. Cached embeddings also make it necessary to keep checking the live index, because intake controls alone cannot remove poison that got in earlier.

Enforcement needs continuing scrutiny as well. The documented Copilot Studio CVE illustrates why a patch is not proof that the full control path is safe. Agents continued to exfiltrate data after Microsoft’s January 2026 patch because a legitimate Outlook action bypassed data-loss-prevention controls, even when safety mechanisms flagged the request. That case concerns action enforcement rather than document detection, but it exposes the same distinction between recognizing risk and preventing its consequence.

External MCP servers and enrichment feeds add dependencies that enterprises do not control at the source. Continuous AI risk intelligence, including vendor AI asset monitoring, gives TPRM and information security teams a way to keep track of new connector risks. Its role is to sustain the technical framework alongside ingestion and response controls as vendors, agents, and content sources change.

Provenance validation and anomaly scoring should run at every ingestion event, while activation monitoring should run at every generation event. Corpus-level graph scoring should run on a schedule across the full index. Vendor connector review should stay part of ongoing third-party AI risk assessment after a connector is approved.